fix(cli): harden the createRequire scan against nested args and comment noise

Match createRequire(fileURLToPath(import.meta.url)) by allowing one level
of nested parens in the argument, skip hits on commented-out lines, and
only scan files that import the module builtin so unrelated functions
named createRequire never warn.

Author: matt-aitken

packages/cli-v3/src/build/createRequireWarnings.test.ts

@@ -128,6 +128,41 @@ globalThis.require = createRequire(import.meta.url);
     expect(scanSourceForCreateRequire(source)).toEqual([]);
   });
 
+  it("finds calls when the createRequire argument contains a nested call", () => {
+    const source = `import { createRequire } from "node:module";
+import { fileURLToPath } from "node:url";
+const mssql = createRequire(fileURLToPath(import.meta.url))("mssql");
+const req = createRequire(fileURLToPath(import.meta.url));
+const pg = req("pg");
+`;
+
+    expect(scanSourceForCreateRequire(source).map((r) => r.specifier)).toEqual(["mssql", "pg"]);
+  });
+
+  it("ignores hits inside comments", () => {
+    const source = `import { createRequire } from "node:module";
+// const mssql = createRequire(import.meta.url)("mssql");
+/* const pg = createRequire(import.meta.url)("pg"); */
+/**
+ * Example: createRequire(import.meta.url)("sharp")
+ */
+const real = createRequire(import.meta.url)("bcrypt");
+`;
+
+    expect(scanSourceForCreateRequire(source).map((r) => r.specifier)).toEqual(["bcrypt"]);
+  });
+
+  it("ignores files that never import the module builtin", () => {
+    const source = `function createRequire(config: string) {
+  return (name: string) => registry.get(config, name);
+}
+const load = createRequire("defaults");
+const plugin = load("mssql");
+`;
+
+    expect(scanSourceForCreateRequire(source)).toEqual([]);
+  });
+
   it("returns nothing when the source doesn't mention createRequire", () => {
     const source = `import mssql from "mssql";
 export const pool = mssql.connect();

packages/cli-v3/src/build/createRequireWarnings.ts

@@ -21,6 +21,8 @@ export type CreateRequireUsage = CreateRequireSpecifier & {
 
 const IDENTIFIER = "[A-Za-z_$][\\w$]*";
 const STRING_LITERAL = `(["'])([^"'\\n]+)\\1`;
+const NESTED_CALL_ARGS = `(?:[^()]|\\([^()]*\\))*`;
+const MODULE_IMPORT_REGEX = /(?:from\s*|require\(\s*|import\(\s*)["'](?:node:)?module["']/;
 
 /**
  * Finds string-literal package specifiers loaded through `createRequire`, e.g.
@@ -33,13 +35,13 @@ const STRING_LITERAL = `(["'])([^"'\\n]+)\\1`;
  * computed specifiers or a re-exported `createRequire` are not detected.
  */
 export function scanSourceForCreateRequire(source: string): CreateRequireSpecifier[] {
-  if (!source.includes("createRequire")) {
+  if (!source.includes("createRequire") || !MODULE_IMPORT_REGEX.test(source)) {
     return [];
   }
 
   const aliases = collectCreateRequireAliases(source);
   const aliasPattern = Array.from(aliases).map(escapeRegExp).join("|");
-  const createRequireCall = `(?:${IDENTIFIER}\\s*\\.\\s*)?(?:${aliasPattern})\\s*\\([^()]*\\)`;
+  const createRequireCall = `(?:${IDENTIFIER}\\s*\\.\\s*)?(?:${aliasPattern})\\s*\\(${NESTED_CALL_ARGS}\\)`;
 
   const results: CreateRequireSpecifier[] = [];
   const seen = new Set<string>();
@@ -51,8 +53,14 @@ export function scanSourceForCreateRequire(source: string): CreateRequireSpecifi
       return;
     }
 
+    const location = locationAt(source, index);
+
+    if (isCommentedOut(location.lineText, location.column)) {
+      return;
+    }
+
     seen.add(key);
-    results.push({ specifier, ...locationAt(source, index) });
+    results.push({ specifier, ...location });
   };
 
   const directCallRegex = new RegExp(
@@ -137,6 +145,21 @@ function isWarnableSpecifier(specifier: string): boolean {
   return !builtinModules.includes(packageNameForSpecifier(specifier));
 }
 
+/**
+ * Line-level heuristic for hits inside comments (commented-out code is the
+ * realistic false-positive source). A `//` or `/*` before the hit on the same
+ * line, or a line shaped like a block-comment continuation, means skip.
+ */
+function isCommentedOut(lineText: string, column: number): boolean {
+  const prefix = lineText.slice(0, column);
+
+  if (prefix.includes("//") || prefix.includes("/*")) {
+    return true;
+  }
+
+  return lineText.trimStart().startsWith("*");
+}
+
 function locationAt(
   source: string,
   index: number